containerd vs Inclavare Containers

containerd is a free container runtime for managing a host’s container lifecycle. It handles image transfer and storage, execution, and supervision, and is designed to be embedded in a larger system rather than used directly by developers or end users. It supports OCI images and image push and pull operations, and uses runc by default while allowing other OCI-compliant runtimes. Its built-in CRI plugin can make it the container runtime for a Kubernetes cluster, and it supports registries compliant with the OCI Distribution Specification. The daemon is available for Linux and Windows. Network-interface management and image building are outside containerd’s first-class scope, so higher-level systems or tools handle those jobs. Its ctr command-line tool is intended for development and debugging, without a guarantee of a stable interface or a human-friendly experience. Users typically also need runc and CNI plugins. The plan is free; free plan available, with no free trial.

Inclavare Containers is a free, open-source Linux container runtime for launching protected containers in hardware-assisted Trusted Execution Environments. It creates hardware-enforced isolation between a tenant workload and privileged cloud-provider software. Its Enclave Attestation Architecture provides remote attestation that sensitive workloads run on trusted TEE hardware. The rune component is described as compliant with the OCI Runtime specification, while documented integrations include dockerd, containerd, and pouchd. Deployment can use Occlum LibOS or WebAssembly Micro Runtime, and Rats-TLS provides an attested secured channel between heterogeneous TEEs. shim-rune handles enclave signing and management between containerd and rune; epm manages cache pools for enclave startup. The project is cloud-platform agnostic and can run on public-cloud Kubernetes platforms. It supports Kubernetes CRI, uses the OCI image format, and documents Linux hosts including Ubuntu 18.04 and Alibaba Linux 2. Installation is described through source builds or RPM/DEB repositories.